CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
40 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-21914 — Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash
- CVE-2025-58153 — BIG-IP HSB vulnerability
- CVE-2025-10151 — Malicious TCP/IP thread locking leads into diverse malfunctions
- CVE-2025-68657 — espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path
- CVE-2025-1221 — DoS in Zigbee device due to heavy traffic
- CVE-2026-20065 — Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability
- CVE-2025-20047 — Improper locking in the Intel(R) Integrated Connectivity I/O interface (CNVi) for some Intel(R) Core™ Ultra Processors m
- CVE-2025-20044 — Improper locking for some Intel(R) TDX Module firmware before version 1.5.13 may allow a privileged user to potentially
- CVE-2026-80126 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-24182 — NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A s
- CVE-2024-32648 — vyper default functions don't respect nonreentrancy keys
- CVE-2026-45404 — OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
- CVE-2025-49178 — Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
- CVE-2025-34467 — ZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pages
- CVE-2025-14345 — Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
- CVE-2026-20757 — Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited
- CVE-2026-54906 — concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption
Recently published
- CVE-2026-80126 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-45404 — OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
- CVE-2026-54906 — concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption
- CVE-2026-24182 — NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A s
- CVE-2026-20065 — Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability
- CVE-2026-20757 — Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited
- CVE-2026-21914 — Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash
- CVE-2025-68657 — espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path
- CVE-2025-34467 — ZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pages
- CVE-2025-14345 — Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
- CVE-2025-10151 — Malicious TCP/IP thread locking leads into diverse malfunctions
- CVE-2025-58153 — BIG-IP HSB vulnerability
- CVE-2025-20044 — Improper locking for some Intel(R) TDX Module firmware before version 1.5.13 may allow a privileged user to potentially
- CVE-2025-1221 — DoS in Zigbee device due to heavy traffic
- CVE-2025-49178 — Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
- CVE-2025-20047 — Improper locking in the Intel(R) Integrated Connectivity I/O interface (CNVi) for some Intel(R) Core™ Ultra Processors m
- CVE-2024-32648 — vyper default functions don't respect nonreentrancy keys
More specific weaknesses
- CWE-1232 — Improper Lock Behavior After Power State Transition
- CWE-1234 — Hardware Internal or Debug Modes Allow Override of Locks
- CWE-412 — Unrestricted Externally Accessible Lock
- CWE-413 — Improper Resource Locking
- CWE-414 — Missing Lock Check
- CWE-609 — Double-Checked Locking
- CWE-764 — Multiple Locks of a Critical Resource
- CWE-765 — Multiple Unlocks of a Critical Resource
- CWE-832 — Unlock of a Resource that is not Locked
- CWE-833 — Deadlock